Build advertiser console with scoped page URLs and runner-based deployment tests

2026-09-16 15:00:52 +08:00
parent 0f8d3ddbf5
commit d64eb72ff2
18 changed files with 3331 additions and 130 deletions
@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+    location = /healthz { access_log off; return 200 'ok'; }
+    location /v1/advertiser/ {
+        proxy_pass ${API_UPSTREAM};
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30s;
+        add_header Cache-Control "no-store" always;
+    }
+    location /assets/ { try_files $uri =404; expires 1y; add_header Cache-Control "public, immutable"; }
+    location / { try_files $uri $uri/ /index.html; add_header Cache-Control "no-cache"; }
+}
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+name=adcloud-advertiser-console
+image="adcloud-advertiser:${SOURCE_REVISION:?}"
+port="${DEPLOY_PORT:-18081}"
+[[ "$port" =~ ^[0-9]+$ ]] && (( port > 0 && port < 65536 )) || { echo 'Invalid deploy port'; exit 1; }
+case "${API_UPSTREAM:?}" in http://*|https://*) ;; *) echo 'Invalid API upstream'; exit 1;; esac
+# A unique candidate verifies the proxy before replacing the published service.
+candidate="${name}-candidate-${SOURCE_REVISION:0:12}"
+cleanup() { docker rm -f "$candidate" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+docker run -d --name "$candidate" --add-host host.docker.internal:host-gateway -e API_UPSTREAM "$image"
+ready=false
+for attempt in {1..30}; do
+  if docker exec "$candidate" wget -q -O /dev/null http://127.0.0.1/healthz; then ready=true; break; fi
+  sleep 1
+done
+[[ "$ready" == true ]] || { echo 'Candidate failed health check'; exit 1; }
+# Auth endpoint should exist and reject unauthenticated requests, rather than 404/502.
+docker exec "$candidate" sh -c 'wget -S -O /dev/null http://127.0.0.1/v1/advertiser/me 2>&1 | grep "401 Unauthorized"'
+old=false
+if docker container inspect "$name" >/dev/null 2>&1; then
+  docker stop "$name"
+  docker rename "$name" "${name}-previous"
+  old=true
+fi
+rollback() {
+  docker rm -f "$name" >/dev/null 2>&1 || true
+  if [[ "$old" == true ]]; then docker rename "${name}-previous" "$name"; docker start "$name"; fi
+}
+if ! docker run -d --name "$name" --restart unless-stopped --add-host host.docker.internal:host-gateway -p "$port:80" -e API_UPSTREAM "$image"; then rollback; exit 1; fi
+ready=false
+for attempt in {1..30}; do
+  if docker exec "$name" wget -q -O /dev/null http://127.0.0.1/healthz; then ready=true; break; fi
+  sleep 1
+done
+if [[ "$ready" != true ]]; then rollback; exit 1; fi
+if ! docker exec "$candidate" wget -q -O /dev/null "http://host.docker.internal:$port/healthz"; then
+  echo "Published port probe failed; restoring previous deployment"
+  rollback
+  exit 1
+fi
+# Browser tests run on this runner against the actual deployed public URL.
+if ! docker run --rm --network host --ipc=host -e BASE_URL "adcloud-advertiser:$SOURCE_REVISION-tests"; then
+  echo 'Deployed browser checks failed; restoring previous frontend'
+  rollback
+  exit 1
+fi
+if [[ "$old" == true ]]; then docker rm "${name}-previous"; fi
+echo "Advertiser console deployed on port $port, revision $SOURCE_REVISION"